rota-spike
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands using
git,jq, and therotaCLI tool to manage branches, track status, and analyze repository history. These commands are triggered by user instructions and rely on the availability of these tools in the environment. - [INDIRECT_PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection by processing external data to generate documentation and execute further commands.
- Ingestion points: The skill ingests untrusted data from user-provided questions (Step 2 of
SKILL.md), git commit logs, and git diff outputs (Step 5 offinish-mode.md). - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when the agent processes branch history or user questions.
- Capability inventory: The agent has the ability to execute shell commands (
git,rota), read/write files in the.rota/spikes/directory, and switch git branches. - Sanitization: While user input is wrapped in double quotes during shell interpolation (e.g., in
rota spike add), there is no explicit sanitization of special characters or command sequences within the user-provided question or repository metadata.
Audit Metadata